The Ground Stop Was (Reportedly) an Accident. A Cyberattack on U.S. Air Travel Would Look Almost Identical.

By the Cyber Law Institute editorial team | Published November 14, 2026 | 8-minute read

This story is developing. Officials say they have found no evidence of a cyberattack, and the root cause has not been finally determined. The “what a cyberattack would look like” sections are analysis, not a claim that an attack occurred. See our editorial standards, corrections policy, and legal disclaimer.

At roughly 3:36 p.m. Eastern on Friday, November 13, 2026, radar and radio communications began to destabilize at air traffic facilities across the United States. By about 4:30 p.m., the FAA had told pilots that all airports were ground stopped. According to TechRadar, it was only the third nationwide ground stop in 25 years.

The first question from reporters was the obvious one: was this a cyberattack?

The answer, so far, appears to be no. But the more unsettling takeaway is how little difference that answer made to the passengers stranded in terminals, the airlines scrambling to reposition aircraft, or the regulators trying to work out who was responsible. A cyberattack on air travel would likely begin the same way: with a communications failure, a cascade of backups, and a very long few hours of not knowing why.

What We Know

• The disruption: The ground stop lasted about five hours, according to CBS News. The FAA expected up to 5,000 flight cancellations on Saturday and anticipated a return to normal levels by Sunday, per MS NOW.
• The symptom: Transportation Secretary Sean Duffy said facilities reported frequencies “going in and out,” forcing controllers to switch between primary and backup systems, per CNN. Because the FAA could not immediately explain why so many facilities were affected, it grounded everything.
• The suspected trigger: Duffy said a router being replaced during a switch from old copper lines to fiber began flooding other routers in the air traffic control network, through either contractor error or faulty equipment. At least one remote FAA location involved contractor L3Harris performing routine maintenance. L3Harris said it takes the incident seriously.
• The age of the system: Duffy described an “incredibly old” air traffic control system that uses analog telecom. CBS sources said a prior review had warned that the technology was no longer supported by the telecommunications infrastructure it relied on.
• The AI angle: The outage came a day after the FAA announced a wider rollout of its AI-backed SMART routing system. The vendor, Air Space Intelligence, said its software did not cause the stop. FAA officials said they saw no evidence of anything AI-related.

What Officials Say It Wasn’t, and What They Haven’t Ruled Out

On Friday evening, Homeland Security Secretary Markwayne Mullin said there was no indication that the incident was a nefarious attack, but he stopped short of certainty. Pressed by reporters, he said there was nothing completely certain right now, and that it appeared mechanically driven but investigators were still looking, per ABC7. By Saturday, Duffy said the department does not believe a cyberattack or foreign-nation attack was responsible, and FAA leadership said it saw zero evidence of anything nefarious. Officials also said the root cause has not been determined.

That is a meaningful distinction for readers of a law site. “No evidence of an attack” is a finding about the present state of an investigation. It is not a finding that an attack is impossible, and the gap between the two is where the legal and operational questions live.

Why the Cause Matters Less Than You Think

Security teams have a name for this problem: the attribution lag. In the first hours of a major outage, an accidental failure and a deliberate one are often indistinguishable. Consider what officials had to decide on Friday afternoon with incomplete information: communications degrading across multiple regions simultaneously, no explanation, and a safety mandate to protect aircraft already in the air. Grounding everything was the cautious call precisely because they could not rule out the worst case.

That is also why the cause of Friday’s event is less important than its shape. The failure mode of an accident and the failure mode of an attack overlap heavily.

What a Cyberattack on Air Travel Would Actually Look Like

The following is a threat analysis, not a prediction. Aviation cyber risk is rarely cinematic. It is less about hijacked planes and more about the connective tissue that keeps a very large system synchronized.

1. The network layer. Modern air traffic control depends on data and voice links between centers. An attacker who could flood, corrupt, or desynchronize that traffic would produce symptoms much like those described on Friday: static on voice lines, flickering screens, and frequencies cutting in and out. Controllers can fall back to backups, but when many facilities fail at once, the safe response is to stop departures.

2. The trusted contractor. Friday’s suspected trigger was routine maintenance by a contractor. Maintenance windows are exactly where privileged access, changes to critical equipment, and weak oversight converge. Supply-chain and third-party access are among the most common routes into critical infrastructure.

3. The bad update. In July 2024, a faulty software update from a security vendor crashed millions of Windows machines worldwide and caused thousands of flight cancellations, with no attacker involved. An adversary who compromised a vendor’s update pipeline could try to cause the same thing on purpose. In January 2023, a damaged file in the FAA’s pilot-notification system triggered a separate nationwide ground stop.

4. The airline and airport back office. In September 2025, a ransomware attack on a provider of airport check-in and boarding software disrupted several major European airports. The planes were fine. The software that checks people onto them was not.

5. The data-integrity attack. Subtler than an outage is corrupting what controllers and pilots trust, such as position, timing, or routing data. These attacks are harder to detect and harder to prove, which is part of what makes them attractive.

The common thread is that the safety culture of aviation turns almost any serious uncertainty into a stoppage. That is a feature for safety and a vulnerability for the economy.

The Legal Fallout Map

Whoever or whatever caused Friday’s disruption, the legal consequences are already taking shape, and they would be broader in a confirmed attack.

• Contractor exposure. If a contractor’s error or defective equipment caused the failure, expect scrutiny of contract terms, indemnities, insurance, and any government-contractor defenses. The cause has not been established, so these are open questions rather than allegations.
• Suing the government is hard. Claims against federal agencies face sovereign immunity and statutory limits. Most affected travelers and businesses will look to airlines and contractors instead.
• Passenger rights. Under U.S. Department of Transportation rules, passengers whose flights are canceled are generally entitled to a refund if they decline the rebooking offered. See DOT’s Aviation Consumer Protection page. Contracts of carriage and fine print still vary by airline.
• Public-company disclosure. If an airline or vendor suffered a material cybersecurity incident, the SEC’s cybersecurity disclosure rules can require a Form 8-K filing within four business days of determining materiality.
• Federal incident reporting. The Cyber Incident Reporting for Critical Infrastructure Act directs CISA to require covered entities to report significant incidents. See CISA’s CIRCIA page for the current status of its rulemaking.
• Evidence and litigation. In any large outage, logs, change tickets, and maintenance records become critical evidence fast. Our Digital Evidence Checklist explains what to preserve.

What Organizations Should Do Now

1. Map your aviation dependencies. Know which of your operations rely on air travel, air cargo, or aviation-adjacent vendors, and what your plan is if the system stops for a day.
2. Treat maintenance windows as high-risk events. Require change approvals, logging, rollback plans, and monitoring for any work on critical network infrastructure, whether by employees or contractors.
3. Rehearse the attribution lag. Run tabletop exercises where you cannot tell whether an outage is an accident or an attack for the first six hours. Decide in advance who declares an incident and who talks to regulators.
4. Review vendor contracts. Look at incident-notification duties, indemnities, and insurance for critical third parties.
5. Align with recognized frameworks. The NIST Cybersecurity Framework gives a common vocabulary for identify, protect, detect, respond, and recover.
6. Report suspected incidents. The FBI’s Internet Crime Complaint Center and CISA are the standard channels.

What Travelers Should Do Now

• Check your airline’s app and site first. Airlines are the source of truth for your flight status.
• Know your refund rights. If your flight is canceled and you do not want the rebooking, ask for a refund, and keep records of your communications.
• Beware of opportunists. Major disruptions attract scammers posing as airline support, offering “priority rebooking” or asking for payment details. Our scams and fraud guide explains how to spot them.
• Protect your data. If an airline or vendor announces a data incident, check our Breach Notice Tracker and data breaches hub.

The Bottom Line

On the evidence released so far, Friday’s ground stop was a failure of an aging system, not an act of war. That is reassuring in one sense and alarming in another. If a router swap during a routine upgrade can stop American aviation for hours, then the margin for a deliberate adversary is not as wide as we would like to believe. The next outage may well be an accident too. The question is whether we will be able to tell the difference quickly, and whether our laws, contracts, and incident plans are ready for the day we cannot.

Frequently Asked Questions

Was Friday’s FAA ground stop a cyberattack? Officials say they have seen no evidence of one and believe the cause was mechanical, tied to a router and telecom upgrade, but the root cause has not been finally determined.

Did the FAA’s new AI system cause it? The FAA’s leadership said it saw zero evidence of anything AI-related, and the SMART system’s vendor said its software was not responsible.

Can I get a refund for a canceled flight? Generally yes, if the airline canceled your flight and you choose not to accept the rebooking. Check DOT’s guidance and your airline’s policy.

Related Reading

• Latest News
• Lawsuits & Settlements
• Identity Theft Guide
• Privacy Rights
• Newsletter signup

Have information about the outage or a related incident? Submit a tip or contact our editors.

Sources

• CNN: What we know about the cause of the nationwide FAA ground stop
• CBS News: FAA lifts nationwide ground stop
• ABC7: Nothing completely certain on cyberattack, Mullin says
• MS NOW: Duffy dismisses cyberattack as cause
• TechRadar: FAA grounds all US flights
• NBC News: FAA lifts ground stop

Publishing notes (not part of the article)

• SEO title: FAA Ground Stop: What a Cyberattack on Air Travel Would Look Like
• Meta description: The FAA’s nationwide ground stop wasn’t a cyberattack, officials say. Here’s why an attack would look almost identical, and the legal fallout.
• Suggested slug: /faa-ground-stop-cyberattack-air-travel/
• Category: Latest News (primary). None of your current hubs is a clean fit, so consider adding a Critical Infrastructure category.
• Before publishing: Update the story as the FAA identifies the root cause. If the cause changes, update the headline and add a dated correction note per your corrections policy. Verify the 2024, 2023, and 2025 background incidents and the CIRCIA rulemaking status against primary sources.